» installation.exe
Overview
Analysis
File Details
Downloads (14)

installation.exe

Salyutem Plyus LLC

This is the OutBrowse Revenyou installer which bundles offers for additional third party applications that may be unwanted and installed without consent. The application installation.exe by Salyutem Plyus has been detected as adware by 11 anti-malware scanners. The program is a setup application that uses the OutBrowse Revenyou installer. The setup routine uses the RevenYou.Com Pay Per Install platform (OutBrowse) which bundles additional software offers inclduing toolbars, extensions, PC utilities as well as other PUPs.

File name:

installation.exe

Publisher:

Salyutem Plyus LLC (signed and verified)

MD5:

df07e00720b6be25dab35041729220c9

SHA-1:

665f68044df4eca6cbd5315ea83d02070e7aff2a

SHA-256:

2cee115ba471128a6ba68328e3937430fadd243df40808154b1821f14f4815d1

Scanner detections:

11 / 68

Status:

Adware

Explanation:

Bundles additional adware offers during download and installation using the OutBrowse installer.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

12/26/2024 11:59:30 AM UTC (today)

Scan engine

Detection

Engine version

AhnLab V3 Security

PUP/Win32.OutBrowse

2014.12.30

Avira AntiVirus

APPL/Outbrowse.Gen

7.11.198.180

AVG

Generic

2015.0.3245

Dr.Web

Trojan.OutBrowse.55

9.0.1.0364

IKARUS anti.virus

Trojan-Clicker.Win32.Agent

t3scan.1.8.5.0

Kaspersky

not-a-virus:Downloader.NSIS.OutBrowse

14.0.0.2718

McAfee

Artemis!DF07E00720B6

5600.6901

Panda Antivirus

Generic Suspicious

14.12.30.10

Qihoo 360 Security

HEUR/QVM42.0.Malware.Gen

1.0.0.1015

Reason Heuristics

PUP.SalyutemPlyus.M

15.1.4.13

Trend Micro House Call

Suspicious_GEN.F47V1229

7.2.364

File size:

574.3 KB (588,104 bytes)

File type:

Executable application (Win32 EXE)

Bundler/Installer:

OutBrowse Revenyou (using Nullsoft Install System)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\installation.exe

Digital Signature

Signed by:

Salyutem Plyus LLC

Authority:

thawte, Inc.

Valid from:

12/15/2014 12:00:00 AM

Valid to:

12/15/2015 11:59:59 PM

Subject:

CN=Salyutem Plyus LLC, O=Salyutem Plyus LLC, L=Kharkiv, S=Arkansas, C=UA

Issuer:

CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:

6B6BB9E1A48F64F47503D8DCF6A5D0D3

File PE Metadata

Compilation timestamp:

12/5/2009 10:50:52 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

12288:YHcT07qSLsYgbtFRwm4rq+y1kDXj7Htb29iCiAlcbIDnQEFuF/2M1:YHvFLsY2tFRwmPfiD/HIQxEFuF/2E

Entry address:

0x30FA

Entry point:

81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00... 
[+]

Entropy:

7.9741

Packer / compiler:

Nullsoft install system v2.x

Code size:

23.5 KB (24,064 bytes)

The file installation.exe has been seen being distributed by the following 14 URLs.

https://doc-08-0c-docs.googleusercontent.com/docs/securesc/p7n229akmkjj3ob5j8jj73qftl1qmert/cplm9u4r4p9kbnc7ragjreqqn108bgsh/1419940800000/02389099468332117340/.../0BwElGBuh7RFGUEpVcEdDU3daV3M?e=download&nonce=0doa6u4tl391k&user=09929313777496515804&hash=l5dmavd5jnbvep5653cjkq6hj3u2e8n1

https://docs.google.com/nonceSigner?nonce=0doa6u4tl391k&continue=https://doc-08-0c-docs.googleusercontent.com/docs/securesc/p7n229akmkjj3ob5j8jj73qftl1qmert/cplm9u4r4p9kbnc7ragjreqqn108bgsh/1419940800000/02389099468332117340/09929313777496515804/0BwElGBuh7RFGUEpVcEdDU3daV3M?e=download&hash=vjg3sq7gibv3qooq2iu393p1v6uir2cf&urp=http://.../download.html&auth=DQAAANAAAADkmKs_Vi2hOSqLRY18t5kHz2hxwgZkhv6Ro9gG54uwhP2u1c-x1grA4AscA_hMKam8kP7x-0S4sfk4MtRuBm_u4bVKQUytjxxOqhBCd7A1TTZhUhIzDxWVNI8og4u_ZEaxktPgrW3E-lhdbGXSR9mPCzJ0irRTVk5DjIakOBQobT-7t2y82Cwvv_3xvlX2PSlYvyajvU92Ysh3qPaubredzV64IhR--zQa0RFQL20Bpmr6rs0snDWehX7kLSFu1r3vofrRwb6Z6ddxwa0Wx8as&authuser=0

https://accounts.google.co.uk/accounts/SetSID?ssdc=1&sidt=ALWU2ctnaDI7ObXqat1jyVqSYiK5sm9NWNUaDnxdbxVqaTvLIlO3mEtPCMuJiZHUpq7ygoT0Hz4tNZIFzjiqJF64C IPGfIBvJ5TI8/fIzex6b60PfaWECzi2/K6wcZYAarKxRv yeswn6tptuO602zxL8V7W2KQ7jzOWL3WZPGYHzN1vWMm13Rtw/x2SLh32mNw xsdQEMUgcE27 Ne3ls5knP868aHHC 8lVdIy479Yd4fSUCI 80we VjogDUcQMw4RlVqaPgfDLeiDbS0WXAVB8aMYYuGssaS97kBr3WZnm1K0foDG1OLv71cURDuDSOkSmNJENoWEDEY7gaO1gb90wYocwfjpOm2Q8iYqSPG5EfkbzGTkm/bgZ6 dOtdYWKT0vi7uZAmAIZMArTnKPuL/P6Jo9uUjl30IY8SNxsT1cor/twRPYUUB4OI7StHa8L2uF1O139PkeRP1XyC8WYOou4ElBG32tIax6IrbzyVM0qY6tGY2JMl7Az/9XMPFYqjUoWaxqrRYzbwF2JO0pJWYspijFuxg2VeZUe1pWdtpZ2zz4PKO4=&continue=https://docs.google.com/nonceSigner?nonce=0doa6u4tl391k&continue=https://doc-08-0c-docs.googleusercontent.com/docs/securesc/p7n229akmkjj3ob5j8jj73qftl1qmert/cplm9u4r4p9kbnc7ragjreqqn108bgsh/1419940800000/02389099468332117340/.../0BwElGBuh7RFGUEpVcEdDU3daV

https://accounts.youtube.com/accounts/SetSID?ssdc=1&sidt=ALWU2cuQzF6U6PArMmNExLgLEQvD7iH naLWhCFKbvO0NbR0WlZyIPzfWTQname/v6zA2L3yDRoasonVXSAItqNfeIa6d777mj6e61q5dwnpFb1ToapdI7sdsJP/1VZDb16l/PD0Ahq8BoasvUJ2oXJKB1Zy ZpVFML5jjvUSwZ9t/stpwFSLHjeB ME0LLSvQ84eqggcYMn24G1WBD5hfk8o8x8ZEglTsPXkmIlQ70hG bjPMCfTswcciRNDnLYkP5xb9JxsHMaZk8TsOHPVxMV95WoQNomx2YMsrXIFRJdWja0Z4Ya0W9z 1MlEpO2KgtNU5973PBZCxxo/InXDVAEZHEzL7drQGF0/pOSAj0kImuANhzsw7U1bT6z0S5lBDeQes4lR3/jQalx5DjOYsoQdD2I/h17ledpv0AvgRQucF0hzT5myU8x5cuSS LmRbOR/VlHk5vdsmn0pqGubga5P3wDI2GydFGLpYnDjjjJd5mRJPZW j3CJko1i5uWe7iSi1/OUwS/15J80GIrcdpJ ji3jsA 9UrEeeu jhvD7qHs GbRGDA=&continue=https://docs.google.com/nonceSigner?nonce=0doa6u4tl391k&continue=https://doc-08-0c-docs.googleusercontent.com/docs/securesc/p7n229akmkjj3ob5j8jj73qftl1qmert/cplm9u4r4p9kbnc7ragjreqqn108bgsh/1419940800000/02389099468332117340/.../0BwElGBuh7RFG

https://accounts.google.com/ServiceLogin?service=writely&passive=1209600&continue=https://docs.google.com/nonceSigner?nonce=0doa6u4tl391k&continue=https://doc-08-0c-docs.googleusercontent.com/docs/securesc/p7n229akmkjj3ob5j8jj73qftl1qmert/cplm9u4r4p9kbnc7ragjreqqn108bgsh/1419940800000/02389099468332117340/09929313777496515804/0BwElGBuh7RFGUEpVcEdDU3daV3M?e=download&hash=vjg3sq7gibv3qooq2iu393p1v6uir2cf&urp=http://.../download.html&followup=https://docs.google.com/nonceSigner?nonce=0doa6u4tl391k&continue=https://doc-08-0c-docs.googleusercontent.com/docs/securesc/p7n229akmkjj3ob5j8jj73qftl1qmert/cplm9u4r4p9kbnc7ragjreqqn108bgsh/1419940800000/02389099468332117340/09929313777496515804/0BwElGBuh7RFGUEpVcEdDU3daV3M?e=download&hash=vjg3sq7gibv3qooq2iu393p1v6uir2cf&urp=http://.../download.html&ltmpl=homepage&emr=1&authuser=0

https://www.google.com/accounts/ServiceLogin?service=writely&passive=1209600&continue=https://docs.google.com/nonceSigner?nonce=0doa6u4tl391k&continue=https://doc-08-0c-docs.googleusercontent.com/docs/securesc/p7n229akmkjj3ob5j8jj73qftl1qmert/cplm9u4r4p9kbnc7ragjreqqn108bgsh/1419940800000/02389099468332117340/09929313777496515804/0BwElGBuh7RFGUEpVcEdDU3daV3M?e=download&hash=vjg3sq7gibv3qooq2iu393p1v6uir2cf&urp=http://.../download.html&followup=https://docs.google.com/nonceSigner?nonce=0doa6u4tl391k&continue=https://doc-08-0c-docs.googleusercontent.com/docs/securesc/p7n229akmkjj3ob5j8jj73qftl1qmert/cplm9u4r4p9kbnc7ragjreqqn108bgsh/1419940800000/02389099468332117340/09929313777496515804/0BwElGBuh7RFGUEpVcEdDU3daV3M?e=download&hash=vjg3sq7gibv3qooq2iu393p1v6uir2cf&urp=http://.../download.html&ltmpl=homepage&emr=1&authuser=0

https://doc-00-7g-docs.googleusercontent.com/docs/securesc/lmdeflgqdcfops1tlnp0glo54girc4l5/006nt2hiln7q24heomrbfmu6uvnkaihb/1420509600000/02389099468332117340/.../0BwElGBuh7RFGUEpVcEdDU3daV3M?e=download&nonce=s1oln57ijmtlu&user=09240574096900735969&hash=jb0urigifa9nbfhur0eh2iohe7lgfifj

https://docs.google.com/nonceSigner?nonce=s1oln57ijmtlu&continue=https://doc-00-7g-docs.googleusercontent.com/docs/securesc/lmdeflgqdcfops1tlnp0glo54girc4l5/006nt2hiln7q24heomrbfmu6uvnkaihb/1420509600000/02389099468332117340/.../0BwElGBuh7RFGUEpVcEdDU3daV3M?e=download&hash=egnb64g8vf21vl2psgo7udvq11lutf53

https://drive.google.com/uc?export=download&confirm=&id=0BwElGBuh7RFGUEpVcEdDU3daV3M

http://bit.ly/1zr6uGO

Remove installation.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.